As a US citizen, I'm alarmed by the requirement for biometrics (e.g., Windows Hello) to access Windows Recall[0]. US courts have not reached consensus on whether biometrics are protected by the 5th amendment[1]. One could argue that because you leave your fingerprints on things and because your face is shown by virtue of it being attached to your person, biometrics are therefore unprotected, and law enformement may be able to use them to unlock devices without your consent. The likelihood of criminals exploiting this is even higher. Passwords and PIN codes are secrets that you can choose to divulge, but with biometrics, a gang could tie you up and simply hover your Android/iPhone over your face to unlock it. I agree that biometrics can enhance security, but if they're the sole source of authentication (as with many popular devices), then they just become an easily exploitable weakness.
As a US citizen, I'm alarmed by the requirement for biometrics (e.g., Windows Hello) to access Windows Recall[0]. US courts have not reached consensus on whether biometrics are protected by the 5th amendment[1]. One could argue that because you leave your fingerprints on things and because your face is shown by virtue of it being attached to your person, biometrics are therefore unprotected, and law enformement may be able to use them to unlock devices without your consent. The likelihood of criminals exploiting this is even higher. Passwords and PIN codes are secrets that you can choose to divulge, but with biometrics, a gang could tie you up and simply hover your Android/iPhone over your face to unlock it. I agree that biometrics can enhance security, but if they're the sole source of authentication (as with many popular devices), then they just become an easily exploitable weakness.
[0] https://support.microsoft.com/en-gb/windows/privacy-and-cont...
[1] https://www.troutman.com/insights/us-v-brown-district-of-col...
Good and thorough analysis. Seems like MS has improved Recall somewhat. But I am still puzzled about why anyone would want this.
By the way: why do browsers only allow deleting the most recent history, and not offer a possibility to delete "everything older than 30 days"?